chore: production readiness audit

- Move plans/ to dev-docs/, delete unused scaffold SVGs
- Create .dockerignore, rename container to immich-folio
- Extract BackLink component and toPhotoItems() helper in page.tsx
- Add keyboard accessibility (role=button, tabIndex, onKeyDown) to PhotoGrid
- Add aria-label to Lightbox EXIF toggle
- Fix React lint: replace setState-in-effect with useState initializer
- Add rate limiting to /api/auth (brute-force protection, 10 RPM)
- Add HSTS and X-DNS-Prefetch-Control security headers
- Add Secure flag to auth cookie in production
- New unit tests: rate-limit.test.ts (5), auth.test.ts (12)
- All 47 tests pass, 0 lint errors, build clean

.dockerignore

@@ -0,0 +1,32 @@
+# Dependencies
+node_modules
+
+# Source control
+.git
+.gitignore
+
+# Build artifacts
+.next
+out
+build
+playwright-report
+test-results
+coverage
+
+# Dev tooling
+dev-docs
+e2e
+*.tsbuildinfo
+next-env.d.ts
+vitest.config.ts
+playwright.config.ts
+eslint.config.mjs
+.prettierrc
+.prettierignore
+
+# Environment files
+.env*
+!.env.local.example
+
+# OS metadata
+.DS_Store